libICP

A golang library for CAdES (CMS Advanced Electronic Signatures) for the Brazilian Public Key Infrastructure (ICP-Brasil).

Features

• Verify X509 digital certificates.
  • Validity check.
  • Integrity/signature check.
  • Download all CAs on request.
  • Check CRLs.
  • Auto download CRLs.
  • Auto download CAs when needed.
  • Support certificate extensions.
    • Basic Constraints.
    • Key Usage.
    • Authority Key Identifier.
    • Subject Key Identifier.
    • Key Usage.
    • Certificate Policies.
    • CRL Distribution Points.
    • Fail when critical extensions are not supported.
• CMS Content type support.
  • protection content
  • ContentInfo
  • data
  • signed-data
  • enveloped-data
• Join multiple signatures files into a single signature file.¹
• Support for smartcard certificates.
• Support for usb certificates.
• Support creation of AD-RB (Digital Signatures with Basic Reference).
  • Add detached signature to unsigned file.
  • Add attached signature to unsigned file.
  • Add cosignature to already signed file.
  • Add countersignature to already signed file.
• Support verification of AD-RB (Digital Signatures with Basic Reference).
• Support creation of AD-RT (Digital Signatures with Time Reference).
• Support verification of AD-RT (Digital Signatures with Time Reference).
• Support creation of AD-RV (Digital Signatures with References for Validation).
• Support verification of AD-RV (Digital Signatures with References for Validation).
• Support creation of AD-RC (Digital Signatures with Complete References).
• Support verification of AD-RC (Digital Signatures with Complete References).
• Support creation of AD-RA (Digital Signatures with References for Archival).
• Support verification of AD-RA (Digital Signatures with References for Archival).

¹: This is intended to handle situations in which multiple people signed a document "in parallel". Ex: a company contract is sent to five people via email. Each of the recipients generates their own signature file and send them back to the company. The company can simply "merge" these signatures into a single signature file as long as they are all valid and about the same document.

Limitations

• Only idPbeWithSHAAnd3KeyTripleDES_CBC (1.2.840.113549.1.12.1.3) using SHA1 is supported for key encryption. (this will change in the future)
• The PFX decoding is a total mess that should be rewritten at some point.

C Wrapper

A C wrapper is available under the c-wrapper directory. See the man files for reference.

If you can't run make docs, look at the .pod file in c-wrapper/docs/src.

License

AGPL - Affero GNU Public License